| 1 |
# The OxygenFlow OpenTofu image |
| 2 |
|
| 3 |
A root file system for deploy jobs (oxygenflow#56): |
| 4 |
|
| 5 |
- Debian bookworm, slim, with CA certificates. |
| 6 |
- OpenTofu 1.13.1, checked against its published SHA-256. |
| 7 |
- A provider mirror in `/opt/tofu/mirror`: `hashicorp/google` 8.7.0 and |
| 8 |
`cloudflare/cloudflare` 5.28.0, checked by `tofu providers mirror` |
| 9 |
against the registry's signed checksums when the image is built. |
| 10 |
- `/etc/tofu/cli.tfrc` (set by `TF_CLI_CONFIG_FILE`) installs providers |
| 11 |
from the mirror only. |
| 12 |
|
| 13 |
So `tofu init`, `fmt` and `validate` need no network; `plan` and `apply` |
| 14 |
reach the cloud's APIs through allow-listed egress (#55). The guest's |
| 15 |
environment is the pipeline's, so a job sets `TF_CLI_CONFIG_FILE` itself |
| 16 |
(below). |
| 17 |
|
| 18 |
## Building and importing |
| 19 |
|
| 20 |
``` |
| 21 |
images/tofu/build.sh /path/to/oxygenflow-tofu.tar |
| 22 |
scp /path/to/oxygenflow-tofu.tar claude@earth:/home/claude/flow/dl/ |
| 23 |
ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-tofu.tar' |
| 24 |
``` |
| 25 |
|
| 26 |
Pin the printed hash in the pipelines that use it, and push it to the hub |
| 27 |
(`flow rootfs push HASH`) so every runner can fetch it. |
| 28 |
|
| 29 |
A provider version in a pipeline's lock file must be in the mirror: bump |
| 30 |
`mirror.tf`, rebuild and re-pin when a lock file changes. |
| 31 |
|
| 32 |
## Using it |
| 33 |
|
| 34 |
```kdl |
| 35 |
sandbox "tofu" { |
| 36 |
runtime "microvm" |
| 37 |
rootfs "cas://blob/<hash printed by flow rootfs import>" |
| 38 |
memory-limit "2GiB" |
| 39 |
cpu-limit 2 |
| 40 |
network "isolated" |
| 41 |
env { |
| 42 |
TF_CLI_CONFIG_FILE "/etc/tofu/cli.tfrc" |
| 43 |
TF_IN_AUTOMATION "1" |
| 44 |
} |
| 45 |
} |
| 46 |
``` |